Can We Stop Pretending SMS Is Secure Now?

Re:Can We Stop Pretending SMS Is Secure Now? by ryanlol on Wednesday March 17, 2021 @09:42PM (#26498937)

You don’t need any of those things, you can just rent a dedicated server (perhaps even a VPS) and send over a LoA and have the host route the IPs to your box.

I’ve never had to deal with colo or think about hardware to have my IPs announce.

[ Parent | on HN ]

Re:Can We Stop Pretending SMS Is Secure Now? by iscoelho on Friday March 19, 2021 @04:33PM (#26517900)

Generally the reason an attacker would do those things is because their hijacks will last much longer due to lack of an abuse department and victims having to contact upstreams.

Shorter ASPath, planning which Tier 1/2 is the best to hijack from, and lack of LOA requirement or RPKI.

If an attacker wants to do this - they don't want to "just" cause damage. This is a limited opportunity. They want to do it right, and that takes planning.

I do agree that your idea is possible, but I don't think it captures the full severity of the issue.

[ Parent | on HN ]